State of MCP server security, November 2026

Headline numbers

of servers answer MCP requests without any login

55.7%

11,682 of 20,981

of servers that require login publish no usable RFC 9728 metadata, so a client cannot discover how to sign in

15.1%

1,395 of 9,255

of open servers give every tool complete, consistent annotations (read-only, destructive and so on)

19.6%

2,286 of 11,673

of open servers show a tool-poisoning signal at high severity

3.3%

374 of 11,450

Each figure has a 95% confidence interval of under ±1 percentage point.

What we found

1. 102open servers (0.9% of the 11,672 whose tools we could see) offer command execution or file access to anyone, with no login.
2. 3.3%of open servers (374 of 11,450) show tool-poisoning signals at high severity: text in a tool's description that tries to instruct the AI model. Lower-severity hints were excluded, as they need human review.
3. 18.1%of open servers (2,111 of 11,672) combine tools that read private data, take in untrusted input and can send data out: the “lethal trifecta”. This is an indicator of risk, not a demonstrated attack.

Tool lists are only visible on servers that answer without login, so the tool findings describe open servers.

What to do

• Require OAuth on every request, as the MCP authorization specification describes.
• Publish RFC 9728 protected-resource metadata, so clients can discover how to sign in.
• Annotate every tool accurately: read-only, destructive, idempotent and open-world.
• Review tool descriptions for text aimed at the AI model, and treat any change to them like a code change.
• Keep tools that read private data apart from tools that send data out, or require confirmation before sending.

How we did it

• Passive only: each server received the requests an ordinary MCP client sends. No tool was called.
• Opt-outs were honoured before any request, and traffic was limited to 1 request per second per provider.
• The scanner identified itself and sent from a published address: see our scanning policy and scanner IPs.
• No response bodies were kept. This report is built from aggregate counts only.
• Accuracy: on a held-out benchmark of real tool descriptions plus known poisoned examples, the tool-poisoning detector's precision was 96% at medium severity and above (benchmark results).

Responsible disclosure

No server is named in this report. Owners of servers with serious issues will be contacted privately and given 90 days to fix them, under our vulnerability disclosure policy.